Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #6  
Old 08-01-2004, 21:39
shyokou
 
Posts: n/a
FLIRT is not omnipotent ...

You may have overlooked one important thing about compiler, the for optimization purpose some "functions" are in fact macros rather than subroutines, especially the str*() series, e.g., strlen() is 90% implemented in macro on i86 target, but 50% subroutine on ARM. You may notice also the if you IDA your own code, the debug version always has the subroutine but the release one not because of optimization ...

A little knowledge about printf(...), it is in most situation a macro of fprintf(STDOUT,...) ...

I dont think it is easy to make signature for macros on i86 target, since the registers may not always the same except EAX ...

Quote:
Originally Posted by Wannabe
I am currently reversing an exe file which has the standard c-libs linked into it.
The problem is that IDA don't recognize basic calls like strcpy, printf and suchs, you have to realize it the hard way by going through the disassembly, or by debugging it ;-)
Is there a way to make IDA realize those calls for what they are? It would really help understanding the real stuff instead of realizing you're fooling around in printf
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Difference dumping @ OEP or runtime ? wildmans General Discussion 4 08-30-2005 20:51


All times are GMT +8. The time now is 23:31.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )